当前讯息：FortiWeb 策略数量限制解决方案

首页 > 数码 > 内容页

当前讯息：FortiWeb 策略数量限制解决方案

2022-12-21 18:13:50 来源：51CTO博客

(相关资料图)

1.背景

由于我司 FortiWeb设备安全防护策略有数量的限制，只允许新建256条策略，对我司根据每一个二级域名匹配一条安全策略是远远不够的。https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiWeb.pdf

公司所有业务系统绑定二级域名已达500余个，为了让业务系统能得到安全的保障，因此我们需要解决策略数量的限制。

2.架构图

3.可行性

3.1.查阅后端负载对应业务系统访问日志

访问：https://wiki.XXXX.com.cn

访问：https://dg.XXX.com.cn

4.安全性

4.1.验证拦截功能

访问：https://dg.XXX.com.cn

sql注入语句：?id=2" and 1=2 union select 1,table_name,3 from information_schema.tables where table_schema=database() limit 0,1

4.2.拦截结果

5.结论

由于以上结果可见，整个业务流程是可以跑通的，并且业务系统也能得到FortiWeb有效的防护。

6.参考内容

6.1.二级代理服务器日志配置

日志格式增加“http_x_forwarded_for”的变量内容，解决（避免）无法取到实际访问者的外网 IP 的情况（经过2级代理后默认的代理服务器日志仅记录上级服务器的地址，例如 WAF 设备地址）。

log_format main "{"@timestamp":"$time_iso8601"," ""host":"$server_addr"," ""clientip":"$remote_addr"," ""size":$body_bytes_sent," ""responsetime":$request_time," ""upstreamtime":"$upstream_response_time"," ""upstreamhost":"$upstream_addr"," ""http_host":"$host"," ""uri":"$uri"," ""domain":"$host"," ""xff":"$http_x_forwarded_for"," ""referer":"$http_referer"," ""tcp_xff":"$proxy_protocol_addr"," ""http_user_agent":"$http_user_agent"," ""status":"$status"}";

log_format main "{"@timestamp":"$time_iso8601","        ""host":"$server_addr","        ""clientip":"$remote_addr","        ""size":$body_bytes_sent,"        ""responsetime":$request_time,"        ""upstreamtime":"$upstream_response_time","        ""upstreamhost":"$upstream_addr","        ""http_host":"$host","        ""uri":"$uri","        ""domain":"$host","        ""xff":"$http_x_forwarded_for","        ""referer":"$http_referer","        ""tcp_xff":"$proxy_protocol_addr","        ""http_user_agent":"$http_user_agent","        ""status":"$status"}";

6.2.二级代理服务器基础配置

由于一级代理已实现 SSL 证书的解析，2级代理无需增加 SSL 证书的配置和内容

upstream wiki443.xxx.com.cn {server 192.168.5.101:8090;keepalive 6000; }server{ listen 80; server_name wiki.XXX.com.cn; access_log /usr/local/nginx/logs/wiki.access.log main; root html; index index.html index.htm; location / { root html; index index.html index.htm; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://wiki443.XXX.com.cn; proxy_connect_timeout 6000s; proxy_send_timeout 6000s; proxy_read_timeout 6000s; proxy_buffer_size 64k; proxy_buffers 4 64k; proxy_busy_buffers_size 128k; proxy_temp_file_write_size 128k; proxy_http_version 1.1; proxy_set_header Connection ""; } error_page 404 /50x.html; error_page 500 502 503 504 /50x.html; location = /50x.html { root html; }

upstream wiki443.xxx.com.cn {server 192.168.5.101:8090;keepalive 6000;    }server{    listen 80;    server_name wiki.XXX.com.cn;    access_log        /usr/local/nginx/logs/wiki.access.log  main;    root html;    index index.html index.htm; location / {   root html;   index  index.html index.htm;   proxy_set_header Host $host;   proxy_set_header X-Real-IP $remote_addr;   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;   proxy_pass http://wiki443.XXX.com.cn;   proxy_connect_timeout 6000s;   proxy_send_timeout 6000s;   proxy_read_timeout 6000s;   proxy_buffer_size 64k;   proxy_buffers   4 64k;   proxy_busy_buffers_size 128k;   proxy_temp_file_write_size 128k;   proxy_http_version 1.1;   proxy_set_header Connection "";   }   error_page  404   /50x.html;   error_page   500 502 503 504  /50x.html;   location = /50x.html {      root   html; }

标签：业务系统代理服务器服务器的